login_message filter not working

Man you really need to read the hooks docs
https://codex.wordpress.org/Plugin_API/Action_Reference/wp_authenticate
https://codex.wordpress.org/Plugin_API/Filter_Reference/login_message

Wp_authenticate receives a parameter, also login_message, but instead of apply_filter you need to use add_filter to show the message something like this:

add_action( 'wp_authenticate', array($this, 'verify_token'), 30, 1);
// even if you aren't using the $username you need to declare it in the function
public function verify_token($username){
    $user_token = afdsDEDFdfsSE234;
    if($user_token == $_GET['token']){
        // the filters always return a value and receive at least one
        add_filter( 'login_message', function($message){
            return __('Token mathed. Now login!','user-registration');
        });
    }
}

Before using a hook you don’t know read the doc, they even have code examples.